curl -X POST https://admin.knoxcall.com/admin/oauth/workload-bindings \
  -H "Authorization: Bearer $SESSION_JWT" \
  -H "X-Tenant-ID: $TENANT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "oauth_client_id": "<your_oauth_client_id>",
    "name": "vercel-acme-prod",
    "issuer": "https://oidc.vercel.com",
    "audience": "knoxcall:api",
    "attribute_conditions": {
      "owner": "acme",
      "project": "api",
      "environment": "production"
    },
    "allowed_scopes": ["routes:read", "secrets:read"],
    "access_token_ttl_seconds": 3600
  }'

// api/list-routes.js (Vercel Edge or Node function)
import { KnoxCall } from "@knoxcall/sdk";

export default async function handler(req, res) {
  const client = new KnoxCall({ tenant: process.env.KNOXCALL_TENANT });
  const routes = await client.routes.list();
  res.json(routes);
}